Log in Start free

Vulnerability · Published Mar 27, 2025 · Assigned by Linux

CVE-2021-4454can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

High 7.5

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.11-1DEBIAN-CVE-2021-4454
Debian:13linux6.1.11-1DEBIAN-CVE-2021-4454
Debian:14linux6.1.11-1DEBIAN-CVE-2021-4454
Ubuntu:22.04:LTSlinux5.15.0-72.79UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-aws5.15.0-1036.40UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure5.15.0-1038.45UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1038.45.1UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-gcp5.15.0-1034.42UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-gke5.15.0-1033.38UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1020.25UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-ibm5.15.0-1030.33UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1030.35UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-kvm5.15.0-1033.38UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-72.79UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1025.25UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-oracle5.15.0-1035.41UBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-raspi5.15.0-1029.31UBUNTU-CVE-2021-4454
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-4454
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-4454
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2021-4454

Affected products (as reported)

VendorProductVersions
Linux Linux 7eef18c0479ba5d9f54fba30cd77c233ebca3eb1 – before 6950df42a03c9ac9290503ced3f371199cb68fa955dd22c5d029423f513fd849e633adf0e9c10d0c – before b6d44072117bba057d50f7a2f96e5d070c65926d0c71437dd50dd687c15d8ca80b3b68f10bb21d63 – before 9ab896775f98ff54b68512f345eed178bf9610840c71437dd50dd687c15d8ca80b3b68f10bb21d63 – before 1740a1e45eee65099a92fb502e1e67e63aad277d0c71437dd50dd687c15d8ca80b3b68f10bb21d63 – before d0553680f94c49bbe0e39eb50d033ba563b4212d5e1fc537c1be332aef9621ca9146aeb3ba59522f5.4.138 – before 5.4.2325.10.56 – before 5.10.168
Linux Linux 5.14

References